5 ms·

I was under the impression that there were scrypt ASICS. Can someone explain how, if true, this is compatible with this claim?

cperciva 10y ago
You can put anything into an ASIC. The only question is how much it costs. But all the "scrypt" ASICs I'm familiar with are limited to computing the nerfed litecoin version anyway.
TD-Linux 10y ago
Take a normal CPU, delete the instructions that aren't used by scrypt, and bam, you have a cheaper and more power efficient chip. In general, you can't prevent ASICs unless you maximally utilize commodity hardware.
jorangreef 10y ago
That's fine, scrypt was designed to defend against the eventuality of scrypt ASICS.
masklinn 10y ago
The point of scrypt is to make ASICs expensive by requiring lots of fast memory. You can always build an ASIC, that doesn't mean the ASIC is cost-efficient.
- amelius 10y ago
  > The point of scrypt is to make ASICs expensive by requiring lots of fast memory But what is the point of that?
  - masklinn 10y ago
    Significantly lower the ROI password-cracking ASICs, more money and die area going to memory means less of it going to compute, and a much lower difference (in hash/s) between regular user and cracker. It all works towards the ultimate end of making cracking passwords too inefficient and expensive for "bad guys" to bother.
  - raverbashing 10y ago
    Not allowing anybody to have an advantage in computing it (as opposed to bcrypt and other systems where an ASIC could be faster than a CPU/GPU)
    - amelius 10y ago
      Okay, but if I buy 10x the amount of hardware I will still be 10x more proficient in mining. So rich people (the ones able to buy lots of ASICs and/or memory) will still have an advantage in mining. So again, what is the point?
      - masklinn 10y ago
        > Okay, but if I buy 10x the amount of hardware I will still be 10x more proficient in mining. Sure. > So rich people (the ones able to buy lots of ASICs and/or memory) will still have an advantage in mining. > So again, what is the point? With non-memory hard hashes, ASICs or GPGPU yield superlinear gain (in hash/s/$) compared to general-purpose CPUs. A 1080 will get you orders of magnitude faster SHA hashing than the pair of i7s you'd get from the same price, and ASICs have an even larger difference. Also scrypt was designed for password storage, not for workproofing dogecoin.
      - Klathmon 10y ago
        Because the alternative of not doing this means you could buy 10x the hardware with specialized ASICs and get 10000x more proficient in mining.
        amelius 10y ago
        So, what is bad about that?
        masklinn 10y ago
        See comment above, scrypt was not designed for cryptocurrency wankery it was designed for password hashing, you don't want the attacker to test billions of hashed passwords per second as that lets them trivially brute-force a DB leak or dump. You want costs to the attacker (hash/second/dollar) to be as similar as they are to the regular user, so that the regular user can crank up difficulty as high as acceptable for their use case (e.g. >100ms/password for a web login).
  - zaroth 10y ago
    The point is just to utilize the commodity hardware to the max. Commodity hardware gives you a lot of memory IO for the buck. You can't spend the same dollars and get 100x more IO. But you can spend the same dollars and get 100x (or more) faster at typical hashes like SHA256. Scrypt uses memory IO so that you can get "your money's worth" by running on an Intel CPU.
panic 10y ago
For some reason Dogecoin, Litecoin, and all the other scrypt-based cryptocurrencies use extremely low N and r parameters, such that computing a hash only needs 128K of memory.
- raverbashing 10y ago
  Maybe using a harder hash does not incentivize people mining it, reducing its growth and liquidity?
  - erik 10y ago
    I'm under the impression that the Litecoin creators thought that scrypt would prevent ASIC miners, but they still wanted to be able to GPU mine, so they used low difficulty parameters. Which of course led to ASIC miners being implemented. Then Dogecoin just copied Litecoin directly.
    - cloudjacker 10y ago
      > thought that scrypt would prevent ASIC miners, I'm still amazed that people believed that. We've been pushing general purpose CPU's for decades because there is nothing novel or hard about making single purpose processors. I didn't realize you could just say random computing terms and people would believe you. "This is memory hard so therefore no ASIC (single purpose processor) could be made because memory is expensive" I like cryptocurrency but 2012-2014 was seriously like being on crazy pills listening to the fans.
      - wmf 10y ago
        To be fair, memory hardness is a legitimate concept with proofs and everything; Litecoin just made a mistake in their design. ZCash is giving it a second try, taking into account improvements that have been made over the last few years.
- tromp 10y ago
  They needed to, in order to make the proof-of-work cheap to verify. See my blog post http://cryptorials.io/beyond-hashcash-proof-work-theres-mining-hashing http://cryptorials.io/beyond-hashcash-proof-work-theres-mini... on how asymmetric PoW avoid this handicap.
CyberDildonics 10y ago
scrypt's memory requirements are not hard coded. Choose a value high enough and an ASIC would not be feasible.

cperciva 10y ago

You can put anything into an ASIC. The only question is how much it costs. But all the "scrypt" ASICs I'm familiar with are limited to computing the nerfed litecoin version anyway.

TD-Linux 10y ago

Take a normal CPU, delete the instructions that aren't used by scrypt, and bam, you have a cheaper and more power efficient chip. In general, you can't prevent ASICs unless you maximally utilize commodity hardware.

jorangreef 10y ago

That's fine, scrypt was designed to defend against the eventuality of scrypt ASICS.

masklinn 10y ago

The point of scrypt is to make ASICs expensive by requiring lots of fast memory. You can always build an ASIC, that doesn't mean the ASIC is cost-efficient.

amelius 10y ago
> The point of scrypt is to make ASICs expensive by requiring lots of fast memory But what is the point of that?
- masklinn 10y ago
  Significantly lower the ROI password-cracking ASICs, more money and die area going to memory means less of it going to compute, and a much lower difference (in hash/s) between regular user and cracker. It all works towards the ultimate end of making cracking passwords too inefficient and expensive for "bad guys" to bother.
- raverbashing 10y ago
  Not allowing anybody to have an advantage in computing it (as opposed to bcrypt and other systems where an ASIC could be faster than a CPU/GPU)
  - amelius 10y ago
    Okay, but if I buy 10x the amount of hardware I will still be 10x more proficient in mining. So rich people (the ones able to buy lots of ASICs and/or memory) will still have an advantage in mining. So again, what is the point?
    - masklinn 10y ago
      > Okay, but if I buy 10x the amount of hardware I will still be 10x more proficient in mining. Sure. > So rich people (the ones able to buy lots of ASICs and/or memory) will still have an advantage in mining. > So again, what is the point? With non-memory hard hashes, ASICs or GPGPU yield superlinear gain (in hash/s/$) compared to general-purpose CPUs. A 1080 will get you orders of magnitude faster SHA hashing than the pair of i7s you'd get from the same price, and ASICs have an even larger difference. Also scrypt was designed for password storage, not for workproofing dogecoin.
    - Klathmon 10y ago
      Because the alternative of not doing this means you could buy 10x the hardware with specialized ASICs and get 10000x more proficient in mining.
      - amelius 10y ago
        So, what is bad about that?
        masklinn 10y ago
        See comment above, scrypt was not designed for cryptocurrency wankery it was designed for password hashing, you don't want the attacker to test billions of hashed passwords per second as that lets them trivially brute-force a DB leak or dump. You want costs to the attacker (hash/second/dollar) to be as similar as they are to the regular user, so that the regular user can crank up difficulty as high as acceptable for their use case (e.g. >100ms/password for a web login).
- zaroth 10y ago
  The point is just to utilize the commodity hardware to the max. Commodity hardware gives you a lot of memory IO for the buck. You can't spend the same dollars and get 100x more IO. But you can spend the same dollars and get 100x (or more) faster at typical hashes like SHA256. Scrypt uses memory IO so that you can get "your money's worth" by running on an Intel CPU.

panic 10y ago

For some reason Dogecoin, Litecoin, and all the other scrypt-based cryptocurrencies use extremely low N and r parameters, such that computing a hash only needs 128K of memory.

raverbashing 10y ago
Maybe using a harder hash does not incentivize people mining it, reducing its growth and liquidity?
- erik 10y ago
  I'm under the impression that the Litecoin creators thought that scrypt would prevent ASIC miners, but they still wanted to be able to GPU mine, so they used low difficulty parameters. Which of course led to ASIC miners being implemented. Then Dogecoin just copied Litecoin directly.
  - cloudjacker 10y ago
    > thought that scrypt would prevent ASIC miners, I'm still amazed that people believed that. We've been pushing general purpose CPU's for decades because there is nothing novel or hard about making single purpose processors. I didn't realize you could just say random computing terms and people would believe you. "This is memory hard so therefore no ASIC (single purpose processor) could be made because memory is expensive" I like cryptocurrency but 2012-2014 was seriously like being on crazy pills listening to the fans.
    - wmf 10y ago
      To be fair, memory hardness is a legitimate concept with proofs and everything; Litecoin just made a mistake in their design. ZCash is giving it a second try, taking into account improvements that have been made over the last few years.
tromp 10y ago
They needed to, in order to make the proof-of-work cheap to verify. See my blog post http://cryptorials.io/beyond-hashcash-proof-work-theres-mining-hashing http://cryptorials.io/beyond-hashcash-proof-work-theres-mini... on how asymmetric PoW avoid this handicap.

CyberDildonics 10y ago

scrypt's memory requirements are not hard coded. Choose a value high enough and an ASIC would not be feasible.